""ET WEB_SERVER Unusually Fast HTTP Requests With Referer Url Matching DoS Tool""
SID: 2014103
Revision: 3
Class Type: web-application-activity
Metadata: created_at 2012_01_10, updated_at 2016_05_25
Reference:
Protocol: tcp
Source Network: $EXTERNAL_NET
Source Port: any
Destination Network: $HTTP_SERVERS
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
-
Value: "Referer|3a 20|"
-
Value: "/slowhttptest/"
Within:
PCRE: "/Referer\x3a\x20[^\r\n]*\/slowhttptest\//Hi"
Special Options:
-
http_header
-
http_header